KMS issue – KMS not receiving Activation Requests from Servers

Question

Hi,
I've got a very strange problem with KMS.  I have recently inherited a SharePoint DMZ environment built using
Best Practices for Securing Active Directory and
CIS Microsoft Windows Server 2008 R2.  All the servers were built using MAK keys, which worked well enough until IT Security locked down firewall access.  Now all the server are going non-genuine. My solution was to setup a KMS activation and
convert all the servers over. Seemed simple enough, even tested it in my Dev Lab no issues once the Windows Firewall was configured to allow KMS (TCP-in). So I set it up started converting servers to KMS, (slmgr /ipk). The client all Windows 2008 R2 Servers
started sending activation requests to the KMS machine, (Event ID: 12288).  Here’s where the problems start, according to the firewall logs on the KMS Server it allows the request in but no Event ID: 12289’s are registered and the client display’s the
following: “Error: 0xC004F074 The Software Licensing Service reported that the computer could not be activated. The Key Management Service (KMS) in unavailable”.
Verified the KMS is active and listening on port 1688. Ran it again with Wire Shark installed and it showed the DCERPC protocol attempting to connect and getting “status: nca_s_fault_access_denied”. Began investigating RPC issues, found two RPC related GPO
entries in our Default Domain Policy and reference in the CIS benchmark referenced above.
Computer Configuration \ <policies> \ Administrative Templates \ System \ Remote Procedure Call
Restrictions for unauthenticated RPC clients
 RPC endpoint mapper client authentication
Both are “Enabled” and the first is set with the following option:
 "Authenticated without Exceptions".
So I proceeded to set these up in my Lab and… BOOM, killed my Lab environment. See
http://blogs.technet.com/b/askds/archive/2011/04/08/restrictions-for-unauthenticated-rpc-clients-the-group-policy-that-punches-your-domain-in-the-face.aspx
After I rebuilt my Lab, I determined the culprit was GPO entry #1 -
Restrictions for unauthenticated RPC clients -
Authenticated without Exceptions.  My attempts at changing this option cause it to “hoop” my lab environment yet
again.
Question time:
Does anyone know how to change this option safely and to not cause the problems I’ve had?
Does anyone have any alternate methods or ideas for setting up KMS in an environment such as mine?
Any help would be greatly appreciated.
Regards,
James

Answer 1

So we determined last this past Friday that I was mistaken, the GPO's in question were not in our Default Domain Policy as a thought...My apologize. They were however in our DMZ Base Server GPO, I was able to drop our KMS Server into a new
sub-OU (called KMS Activations) and then provide a GPO override in that OU for the following line:
Computer Configuration \ <policies> \ Administrative Templates \ System \ Remote Procedure Call\Restrictions for unauthenticated RPC clients
and set it to: "Authenticated".
Once we did this plus STOP and Start SPP Service, we ran Slmgr / ato  on 5 servers to hit the threshold, the rest of the server activated on their own over the weekend.
Confirmed this morning, once we flipped the remaining servers over from MAK to KMS they activated on their own. Modifying our build template to have the KMS key now not the MAK.
Still not sure what grants KMS the exception to the GPO, assuming the Firewall?
The original was "Authenticated without Exceptions" verses the Current "Authenticated" so the only real difference is that exceptions are aloud if authorized
by something.
I appreciate the responses.